Quickpost Archives | Forensic Blogs

July 2, 2019 by Didier Stevens

Quickpost: nslookup Types

A reminder to myself, how to set a nslookup type via the command-line:

The label of the root domain is an empty string, hence a FQDN with root domain ends with a dot (.), like google.com. :

Quickpost info

June 10, 2019 by Didier Stevens

Quickpost: C Random Functions in Other Languages

Some time ago, I had to implement a particular C-runtime random number generator in Python. That’s not difficult to do, you just need a variable that maintains the state (seed) of the random number generator, and then you use a simple algebraic expression: a linear congruential generator.

What’s more difficult to figure out, is knowing which multiplier (a) and increment (c) you need to reproduce the particular C-runtime random number generator.

Fortunately, I discovered that Wikipedia has a table with a and c values for many C compilers and other languages: parameters in common use.

Quickpost info

May 19, 2019 by Didier Stevens

Quickpost: Retrieving an SSL Certificate with nmap

One of my first quickposts, more than 10 years ago, was an howto: using openssl to retrieve the certificate of a web site.

Since then, nmap has a scripting engine, and there is a script to check a certificate with nmap: ssl-cert.nse.

You just have to scan the site and port for which you want to check the certificate, like this: nmap -p 443 –script ssl-cert didierstevens.com

If you want the certificate too, increase verbosity with option -v:

Checking a certificate will not work if you scan a port that is not known to provide SSL/TLS:

In that case, you have to use service discovery (-sV):

Quickpost info